Karen is dedicated to helping federal agencies and others communicate technical cybersecurity info to external and internal audiences. Karen founded her company on the belief that security professionals will continue to fall behind attackers until we become more adept at communication.

Karen was formerly a Senior Computer Scientist at NIST, where she developed security publications for federal agencies and the public. She holds master's degrees in computer science and technical writing, and she's worked in IT for over 30 years.

Karen Scarfone's Publications and Blog

Here are links to my online publications and blog posts! Sign up to get a weekly email update when I release a new pub or blog post. 

NIST •

SP 800-221A, Information and Communications Technology Risk Outcomes

Information and Communications Technology (ICT) spans all tools, devices, data, infrastructure, and components and it’s a broad concept that continues to evolve. This publication provides desired outcomes and applicable references common across all types of ICT risk; it offers a common language for understanding, managing, and expressing ICT risk to internal and external stakeholders and can help identify and prioritize actions to reduce ICT risk. The core of this publication can be browsed and downloaded in popular formats such as JSON and Excel using the NIST Cybersecurity and Privacy Tool (CPRT).
NIST •

SP 800-221, Enterprise Impact of Information and Communications Technology Risk

Information and Communications Technology (ICT) spans all tools, devices, data, infrastructure, and components and it’s a broad concept that continues to evolve. This publication helps in understanding the relationship between ICT risk management and ERM—and the benefits of integrating those approaches. This includes ICT risk guidance on how all ICT risk programs, including individual programs such as privacy, supply chain, and cybersecurity, integrate into ERM.
NIST •

Data Classification Concepts and Considerations for Improving Data Protection

Data classification is the process an organization uses to characterize its data assets using persistent labels so those assets can be managed properly. This publication defines basic terminology and explains fundamental concepts in data classification so there is a common language for all to use. It can also help organizations improve the quality and efficiency of their data protection approaches by becoming more aware of data classification considerations and taking them into account in business and mission use cases, such as secure data sharing, compliance reporting and monitoring, ZTA, and LLMs.
FedTech •

Improved Cybersecurity Logging Gives Agencies Better Network Visibility

Each agency should use logging in conjunction with various tools for finding vulnerabilities on each of its IP network-connected technology assets, including missing patches, outdated software versions in need of upgrading, and misconfigured software and services. Most agencies will need to use several tools in combination to achieve the necessary visibility for all of their assets, no matter where each asset is located at any time. Let’s take a closer look at some of these tools.
Load More